142 lines
3.6 KiB
YAML
142 lines
3.6 KiB
YAML
---
|
|
- name: Update apt cache
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
|
|
- name: Install essential packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- apt-transport-https
|
|
- ca-certificates
|
|
- curl
|
|
- gnupg
|
|
- lsb-release
|
|
- ufw
|
|
- fail2ban
|
|
- git
|
|
state: present
|
|
|
|
# Swap (only when the inventory defines swap_size_mb)
|
|
- name: Create swap file
|
|
ansible.builtin.shell:
|
|
cmd: fallocate -l {{ swap_size_mb }}M /swapfile && chmod 600 /swapfile && mkswap /swapfile
|
|
creates: /swapfile
|
|
when: swap_size_mb is defined
|
|
|
|
- name: Enable swap file
|
|
ansible.builtin.shell: swapon --show=NAME --noheadings | grep -q /swapfile || swapon /swapfile
|
|
changed_when: false
|
|
when: swap_size_mb is defined
|
|
|
|
- name: Persist swap in fstab
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/fstab
|
|
line: /swapfile none swap sw 0 0
|
|
when: swap_size_mb is defined
|
|
|
|
- name: Set swappiness
|
|
ansible.builtin.copy:
|
|
content: "vm.swappiness=10\n"
|
|
dest: /etc/sysctl.d/99-swappiness.conf
|
|
mode: "0644"
|
|
register: swappiness_conf
|
|
when: swap_size_mb is defined
|
|
|
|
- name: Apply swappiness
|
|
ansible.builtin.command: sysctl -w vm.swappiness=10
|
|
when: swap_size_mb is defined and swappiness_conf.changed
|
|
|
|
# Firewall
|
|
- name: Configure UFW rules
|
|
ansible.builtin.shell: |
|
|
ufw allow 22/tcp
|
|
ufw allow 80/tcp
|
|
ufw allow 443/tcp
|
|
{% if install_forgejo | default(true) %}
|
|
ufw allow {{ forgejo_ssh_port | default(2222) }}/tcp
|
|
{% endif %}
|
|
ufw --force enable
|
|
ufw default deny incoming
|
|
changed_when: false
|
|
|
|
# Fail2ban
|
|
- name: Enable fail2ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
enabled: true
|
|
state: started
|
|
|
|
# Docker
|
|
- name: Ensure keyrings directory exists
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Add Docker GPG key
|
|
ansible.builtin.shell:
|
|
cmd: curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc && chmod 644 /etc/apt/keyrings/docker.asc
|
|
creates: /etc/apt/keyrings/docker.asc
|
|
|
|
- name: Add Docker apt repository
|
|
ansible.builtin.apt_repository:
|
|
repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
|
|
state: present
|
|
|
|
- name: Install Docker
|
|
ansible.builtin.apt:
|
|
name:
|
|
- docker-ce
|
|
- docker-ce-cli
|
|
- containerd.io
|
|
- docker-buildx-plugin
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Start Docker
|
|
ansible.builtin.systemd:
|
|
name: docker
|
|
enabled: true
|
|
state: started
|
|
|
|
# Docker network
|
|
- name: Create Docker network
|
|
ansible.builtin.shell: docker network inspect {{ docker_network }} >/dev/null 2>&1 || docker network create {{ docker_network }}
|
|
changed_when: false
|
|
|
|
# SSH key (for cloning from Forgejo)
|
|
- name: Generate SSH key
|
|
ansible.builtin.shell:
|
|
cmd: ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519 -N "" -q
|
|
creates: /root/.ssh/id_ed25519
|
|
|
|
- name: Read SSH public key
|
|
ansible.builtin.command: cat /root/.ssh/id_ed25519.pub
|
|
register: ssh_public_key
|
|
changed_when: false
|
|
|
|
- name: Show SSH public key
|
|
ansible.builtin.debug:
|
|
msg: "Add this SSH key to Forgejo (Settings > SSH Keys): {{ ssh_public_key.stdout }}"
|
|
|
|
# App directories
|
|
- name: Create app directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: "0755"
|
|
loop:
|
|
- /opt/church-website
|
|
- "{{ repo_dir }}"
|
|
- "{{ envs_dir }}"
|
|
- "{{ scripts_dir }}"
|
|
|
|
- name: Create environment directories
|
|
ansible.builtin.file:
|
|
path: "{{ envs_dir }}/{{ item.name }}"
|
|
state: directory
|
|
mode: "0750"
|
|
loop: "{{ app_environments }}"
|
|
loop_control:
|
|
label: "{{ item.name }}"
|